My situation :

Me(localhost) -> Server A(ip: =>(server B(ip:,server....)

i'm able to SSH into server since it has a true ip if i then want to connect to server b, i would ssh server b with it's ip(


from my pc:

ssh user@

then in,

ssh user@

this would get me to server B with ssh

what if i want to connect to server b directly? how can i do that?


from my oc:


i have tried the following:

ssh -L 22:localhost:22 user@

without success


Your problem is in binding a listener to localhost:22; there's already an sshd listening on that. Tunnelling an ssh connection through an ssh connection is completely lawful, and I do it all the time, but you need to pick unused ports for your forwarding listeners.


me% ssh user@ -L 2201:


me% ssh localhost -p 2201

You should end up on server B (unless something's already bound to me:2201, in which case, pick another port).

  • thanks for the quick reply! it does work, however, how i can forward all connections instead of only ssh(22)? – tom91136 Dec 15 '11 at 12:00
  • 1
    That's a full-blown VPN you're looking for, not just port-forwarding. There's a writeup on how to do vpn-over-ssh at bodhizazen.net/Tutorials/VPN-Over-SSH , but it requires remote root access via ssh on A. Or you could look into OpenVPN or other VPN solutions, but again, you'll need privilege on A to make these work. – MadHatter Dec 15 '11 at 12:06
  • thanks a lot, one last thing, what if i only want to connect to A? – tom91136 Dec 15 '11 at 12:12
  • me% ssh user@ ; didn't we already cover that? or do you mean "what if I want a full-blown VPN to A?", in which case my answer stands. – MadHatter Dec 15 '11 at 12:19
  • 1
    For people who want VPN over SSH, don't have root access on the server but it does have Python, try sshuttle. – André Paramés Dec 15 '11 at 15:50

You don't have to use ssh port forwarding to ssh into an internal computer through a proxy. You can use the ssh feature of executing a command on the first server you connect to in order to ssh into a 3rd computer.

ssh -t user@ ssh user@

The -t option forces ssh to allocate a pseudo-tty so you can run an interactive command.

This can work with ssh keys as well. If you have your private and public key on machine A and your public key in the authorized keys files on machines B and C, then you can use the -A option to forward the authentication agent connection.

  • 2
    Use -A with caution and only if the jump host is fully trusted. A safer and simpler alternative is to use ssh -J jumphost destination if the -J option is available. – coldfix Aug 10 '20 at 16:01

As of OpenSSH 7.3 (late 2016) the easiest way is the ProxyJump setting. In your ~/.ssh/config:

Host B
  ProxyJump A

Or on the command line, , -J B.


I used a different solution. I used a ProxyCommand option (here in ~/.ssh/config):

Host myinsidehost1 myinsidehost2 myinsidehost3
ProxyCommand ssh externalhost ssh %h sshd -i

This doesn't set up any port-to-port tunnel, instead tunnels ssh by using standard stdin/out. This method has a drawback that there are actually three ssh connections to authenticate. But to connect to the internal host you just type:

ssh myinsidehost2

...so you do not need to care about choosing any IP for that tunnel.

  • 1
    This is the only kind of SSH stacking that I find working. I've been tried corkscrew or nc (netcat) but none work as seamlessly as this. – Phuong Nguyen Sep 16 '14 at 16:38

according to the ssh man page, ProxyCommand is the correct method

the syntax being:

ProxyCommand ssh -W %h:%p user@jumphost 2> /dev/null
  • I am not sure the -W option existed when this question was answered. But with newer versions of the ssh client, I agree that the combination of ProxyCommand and -W is the preferred method. Maybe add some context showing both how it can be used on the command line as well as an example of a section for .ssh/config. – kasperd Jul 21 '15 at 8:18
  • Any idea where to find the changelogs/version info that tells us which versions of SSH have the -W command and which don't? A bit of googling did not yield answers quickly for me... – dmh Aug 1 '17 at 13:01
  • -W got introduced with OpenSSH 5.4, released in 2010. So the answer is yes @kasperd – 0xC0000022L Mar 27 '18 at 19:59

While ProxyJump has already been mentioned, it's most useful for static hosts you keep connecting to. If the machines keep changing, it's much easier to use -J (jump host) command line argument:

Once you know what it's doing, the syntax is pretty straightforward:

ssh -J user1@ user2@

The above command establishes a connection to as user1, then from there "jumps" to as user2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.